Threats tagged 'ghsa-f7v4-wpwr-74r2'

The Rank Math SEO plugin for WordPress contains a PHP Object Injection vulnerability in all versions up to and including 1.0.276. This flaw exists due to unsafe deserialization of untrusted input in the updateMeta REST API endpoint. Authenticated users with Contributor-level access or higher can exploit this to inject PHP objects. Exploitation can lead to remote code execution by leveraging a POP chain to write a webshell to the uploads directory.